Privacy Notice (KVKK)
This is an informational translation; the Turkish version prevails.
Last updated: 15.10.2026 · Version: 2026-10-15
This notice has been prepared by İkra Hidro Pompa as data controller pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. The notice covers persons who use the supomp.com website and the Supomp Android app, who shop as a member or without membership, who apply for a business account, who contact us via support chat, contact form, e-mail, phone or WhatsApp, and who post reviews or questions. Personal data of our employees is not covered by this notice; a separate notice applies to our employees.
More detailed explanations of how your data is processed are set out in the Privacy Policy.
1. Data controller
- Trade name: Mehmet Vehbi Kamacı – İkra Hidro Pompa (sole proprietorship; brand: Supomp)
- Tax office and tax number: Uludağ · 4941110888
- Address: Celal Bayar Caddesi, Sakarya Mahallesi No: 74/A, Gazcılar, Osmangazi / Bursa
- Phone: 0531 565 11 25
- E-mail: ikrahidropomp@gmail.com
2. Categories of personal data we process
- Identity: full name; Turkish ID number when you enter it for invoicing or a business account application.
- Contact: e-mail address, phone number, delivery and billing address.
- Customer transaction: order, cart, favorite, quote, coupon, return and shipping information; support chat, contact form and e-mail correspondence; withdrawal notices, defect notifications and complaints; reviews and questions and related notifications; business account application information; our employees' customer and order notes; the time and version of the text when you accept the terms of use and the review rules.
- Finance: payment method, payment status and amounts, transaction number of the payment institution and installment information, tax office and tax identification number, bank transfer/EFT receipt. Your card details are not processed by us; they are transmitted directly to the payment institution.
- Transaction security: password hash, session information, login and session records of the authentication system (time, IP address, browser information), salted hash of the IP address, rate-limit and coupon attempt records, servers' technical logs, chat transaction logs of the support team.
- Location: the one-off location you share in the support chat via "Send location". For services provided only in certain provinces, such as installation, the province check performed via "Check by my location" is carried out entirely on your device; your location is not sent to us or to third parties and is not recorded.
- Visual and audio records: photos, videos and voice messages you send in the support chat; photos you add to reviews; the profile photo you optionally upload.
- Device and usage information: account ID or the anonymous session ID created in guest checkout; if you have granted notification permission, the notification token, Firebase installation ID, random device ID generated by the app, device platform and app version; if you have allowed statistics measurement, device and session identifiers, navigation and interaction logs, search terms, device type, operating system, browser name and site errors.
We do not knowingly process the special categories of personal data listed in Article 6 of KVKK (such as health information). Please do not share such information in the support chat or other channels; if you do share it, you may request its deletion.
3. Processing purposes and legal grounds
| Purpose | Data processed | Legal basis |
|---|---|---|
| Opening the membership account, authentication and account management | Identity, contact, transaction security | Formation and performance of the contract (Art. 5/2-c) |
| Storing the cart, favorites and recently viewed products in guest checkout (anonymous session) | Device and usage information (anonymous session ID), customer transaction, transaction security (session records) | Formation and performance of the contract (Art. 5/2-c); legitimate interest for session security (Art. 5/2-f) |
| After an order placed and paid for without membership, sending a link to the e-mail address on the order to create an account or add the order to an existing account (contains no promotional content; the account is opened only when a password is set via the link) | Contact (e-mail address), customer transaction (order number), transaction security (one-way hash of the link, time of use) | Legitimate interest (Art. 5/2-f); formation and performance of the contract (Art. 5/2-c) if you open the account |
| Receiving the order, formation and performance of the distance sales agreement; delivery, withdrawal, return, exchange and warranty processes | Identity, contact, customer transaction, finance | Formation and performance of the contract (Art. 5/2-c) |
| Collecting payment; installment and down-payment payments; payment refunds | Identity, contact, finance, transaction security (IP address) | Formation and performance of the contract (Art. 5/2-c) |
| Issuing invoices, keeping commercial books and documents, retaining distance contract records (including withdrawal notices, defect notifications and complaints submitted via chat) | Identity, contact, finance, customer transaction | Legal obligation (Art. 5/2-c) |
| Evaluating business account applications, business pricing and preparing the price quotation you request | Identity, contact, finance, customer transaction | Formation and performance of the contract (Art. 5/2-c) |
| Responding to questions, requests and complaints received through support chat, contact form, e-mail, telephone and WhatsApp | Identity, contact, customer transaction, location, visual and audio records | Formation and performance of the contract (art. 5/2-c); legitimate interest (art. 5/2-f) |
| Providing support responses outside business hours via İkra AI | Identity (first name), customer transaction (chat history, support team responses, order, account and cart summary), visual records (photos), location (location you share) | Formation and performance of the contract (art. 5/2-c); legitimate interest (art. 5/2-f) |
| Reviewing, publishing and responding to reviews and questions, and examining reported content | Identity (name), contact (e-mail provided for the question), customer transaction, visual records | Formation and performance of the contract (art. 5/2-c); legitimate interest (art. 5/2-f) |
| Sending transactional notifications such as order status and support responses | Device and usage information (notification token and device record), customer transaction | Formation and performance of the contract (Art. 5/2-c) |
| Ensuring information security and business continuity (including backups), preventing fraud and misuse, auditing support team access | Transaction security (login and session records, IP summary, rate limit and coupon attempt records, chat transaction records); statistical records are not used for this purpose | Legitimate interest (Art. 5/2-f); legal obligation with respect to record-keeping requirements arising from legislation (Art. 5/2-c) |
| Carrying out and team-side monitoring of account, cart, order, quotation and support operations (service records) | Customer transaction (cart, order, quotation, favorite, price/stock alert, support chat initiation and message type; not message content), account identifier (member or anonymous session ID), transaction time | Formation and performance of the contract (art. 5/2-c); legitimate interest for operating the service, customer support and preventing misuse (art. 5/2-f) |
| Statistical measurement and debugging | Device and usage information, transaction security (IP summary); account identifier if you are logged in | Explicit consent (art. 5/1) |
| Establishment, exercise and protection of rights in legal disputes | Categories related to the dispute | Establishment, exercise or protection of a right (art. 5/2-e) |
| Responding to information requests from competent authorities and institutions | Requested categories | Legal obligation (Art. 5/2-c) |
The only processing based on explicit consent is statistical measurement; it is optional and your refusal to consent does not prevent you from shopping or using other services. Details: Explicit Consent Statement. Service records are not statistical measurement, are not based on explicit consent and do not contain device, session, IP, page or referrer information. We do not send campaign e-mails, SMS or campaign notifications.
4. Method of collection
Your personal data is collected through the membership, order, business application, contact, review and question forms on the supomp.com website and the Supomp Android application, through the support chat and İkra AI, and during use of the site and application by means of browser storage technologies and server logs by partially or fully automated means; and by non-automated means in respect of information you transmit by telephone, e-mail, WhatsApp and mail. Information regarding the outcome of the payment is obtained from the payment institution PayTR.
5. Transfer of personal data
Recipients in Türkiye
- Payment institution PayTR and banks: collection of payment, installment and refund transactions. For card payments, your IP address, name and surname, e-mail address, telephone number, billing address, cart contents and amount are transmitted to PayTR; your card information is obtained by PayTR directly from you.
- Cargo companies and our cargo integration service provider (Basit Kargo): name and surname, delivery address, telephone number, e-mail address and shipment information in order to create the shipment, prepare the cargo label and track the delivery.
- Accounting and e-invoice service providers: invoice information for invoice and accounting records.
- Technical service provider (software development, maintenance and server management): data within the scope of administrative access for the operation, maintenance and security of the system.
- Competent public authorities and institutions, judicial authorities: information requested as required by legislation.
Recipients abroad
| Recipient and country | Purpose and data transferred | Transfer safeguard |
|---|---|---|
| netcup GmbH (server and hosting) · Germany | The site, the application, the database and the files are hosted on this provider's servers; all data listed in this text is stored on these servers. | Standard contract (KVKK art. 9/4; the signing and notification to the Authority process is ongoing) |
| Cloudflare, Inc. (domain name, DNS, content delivery and security) · USA; servers are distributed across many countries | Your IP address and request information when the site pages, publicly available images, e-mail verification links and payment return pages are transmitted. | Standard contract (KVKK art. 9/4; the signing and notification to the Authority process is ongoing) |
| Resend (e-mail delivery service) · USA | Your e-mail address and the content of the e-mail for account e-mails (membership verification, e-mail change, password reset) and e-mails related to your order. | Standard contract (KVKK art. 9/4; the signing and notification to the Authority process is ongoing) |
| Google LLC (Firebase Cloud Messaging) · USA | Only to deliver a notification to the Android device for which you have granted notification permission: the notification token, the Firebase installation ID and the title and short text of the notification. | Standard contract (KVKK art. 9/4; the signing and notification to the Authority process is ongoing) |
| Anthropic PBC (Claude API) · USA | To enable İkra AI to generate responses: your chat messages and the support team's responses in the chat, your photos, the location you share, chat summary, your first name and the order, account and cart summary related to your question. | Standard contract (KVKK art. 9/4; the signing and notification to the Authority process is ongoing) |
| Google LLC (Gmail) · USA | The content of correspondence conducted using our company e-mail address and your contact information. | Standard contract (KVKK art. 9/4; the switch to a business account, signing and notification to the Authority process is ongoing) |
| Google LLC (Google Drive, backup storage) · USA | Encrypted backups of the database and files. Backups are encrypted with AES-256 before being uploaded; the encryption key is not held by Google. | Standard contract (KVKK art. 9/4; the switch to a business account, signing and notification to the Authority process is ongoing) |
| Google LLC (Google Maps) · USA | When you tap the "Open on map" link on the contact page or in the chat: your IP address and browser information; when you open it from the chat, also location coordinates. | Operation initiated by you; the service's own terms apply. |
| Google LLC (YouTube, privacy-enhanced mode) · USA | When you tap the "Play" button of a video on product pages or on the "Videos and images" page: your IP address, browser information and the address of the video you watch; during playback, YouTube may keep its own records on your device. | Operation initiated by you; the service's own terms apply. |
| WhatsApp (Meta) · USA / Ireland | Only if you choose to message us via WhatsApp: your telephone number and the content of the correspondence. | Operation initiated by you; the service's own terms apply. |
Google LLC (USA) — ad conversion measurement: only for visitors who enable “Advertising measurement” in the cookie preferences; the transferred data are limited to the ad click identifier, action type, order/quote number, date and amount (name, e-mail and phone are not transferred). Legal basis: explicit consent (KVKK Art. 5/1 and Art. 9). Retention: click identifier 90 days, conversion record 13 months. Consent can be withdrawn at any time in the cookie preferences.
For transfers of personal data to recipients abroad, pursuant to article 9 of the KVKK, the standard contracts announced by the Personal Data Protection Board are relied on as a safeguard. The process of signing these contracts and notifying them to the Personal Data Protection Authority within 5 business days of the date of signature is carried out; the notification dates of completed contracts are also shown separately in this section. Some of these services are used through our technical service provider as its sub-processor. Subsequent transfers made to sub-processors used by the recipients while providing their services are also subject to the same safeguards. We do not request your explicit consent for transfers abroad. Data is transmitted to the services shown as "Transaction initiated by you" in the table only when you choose to use that service and within the scope of the transaction you initiate; the privacy terms of those services apply.
For the map image of the location shared in the chat, OpenStreetMap map tiles are obtained via our server; no personal data is transmitted to OpenStreetMap during this process.
6. Retention periods
| Data | Retention period |
|---|---|
| Membership account, profile and preferences, address book, favorites, cart and recently viewed products | Until you delete your account. Deletion occurs immediately. |
| Anonymous session and its associated cart, favorites and recently viewed products | If never used, 7 days; if there is a cart, favorite or alert record, or if membership verification is pending, 30 days after last use; if an order has been placed, deleted 180 days after the last transaction. |
| Post-order account creation link record (email address, order, one-way digest of the link, time of use) | The link is valid for 7 days; the record is deleted after 30 days. |
| Business account application information | For as long as your account remains open. If your application is rejected, your tax identification number or Turkish ID number is deleted 6 months after rejection. |
| Order and invoice records | 10 years (the retention period for commercial books and documents and the general statute of limitations for contractual claims). |
| Telephone number on the order, order note, IP digest and shipping details | 3 years. |
| Withdrawal notices, defect notifications and complaints (including those sent via chat, transferred to the order record) | 3 years. |
| Quotes and quote carts that do not result in an order | 1 year after the quote's validity period ends. |
| Transaction notifications for your account (order, payment, business account application result) | 1 year. |
| Support chat messages and files (including İkra AI messages) | 2 years; automatically deleted when the period expires. Chat records containing no messages are deleted after 30 days. |
| Support team's chat action logs (does not include message content) | 2 years. |
| İkra AI temporary model history | When the chat is idle for 1 hour; in any case within at most 1 day. |
| İkra AI chat summary | When you clear the chat or when the chat or your account is deleted; at most 2 years. |
| İkra AI usage and cost records (does not include message content) | 400 days. |
| Contact form messages | 2 years. |
| Email address you provide as a guest in a product question | 6 months after your question is answered. |
| Published reviews and questions | For as long as they remain published; reviews are kept published for at least 1 year from the publication date unless you request their removal. |
| Review and question reports ("Report") | 1 year after the review is completed. |
| Push notification token and device record | When you sign out, turn off notifications, delete your account, when the token becomes invalid, or when the app is not used for 270 days. |
| Record of sent notifications | The notification text is deleted after sending; the record itself is kept for 7 days, at most 30 days. |
| Statistics and error logs (if you have consented) | 13 months; automatically deleted when the period expires. If you withdraw your consent, they are deleted or anonymized within at most 30 days. |
| Service logs (cart, order, quote, support chat initiation and message type, favorite, alert, account creation, membership and login) | 13 months; automatically deleted when the period expires. Deleted together when your account is deleted or when your anonymous session is deleted within the periods above. |
| Rate limit records for security purposes | 2 hours. |
| Authentication system logs | Member login and password transactions (time, IP address, browser information) 2 years; session renewal records and records of anonymous sessions and deleted accounts 90 days. |
| Technical server logs (access logs) | At most 1 year. |
| Encrypted backups | Backups are taken every night; daily backups are kept for 14 days, and weekly and monthly backups for a maximum of 6 months. Deleted data is also removed from backups within 7 months at the latest. |
| Records on your device | The periods specified in the Cookie Policy. |
Data whose retention period has expired is deleted, destroyed or anonymized; these operations are recorded. When you delete your account, which data is deleted immediately, which is anonymized and which is retained is explained on the Account and Data Deletion page.
7. Automated decision-making
Decisions that produce legal consequences concerning you or significantly affect you are not made solely by automated systems. Our AI assistant İkra AI does not place orders, confirm or cancel orders and does not set prices; these tasks are carried out by our employees. The automated rate limits applied to prevent misuse only temporarily halt operations in which a large number of attempts are made in a short time (for example coupon attempts).
8. Your rights
Pursuant to article 11 of the KVKK, by applying to the data controller, you have the right to:
- Learn whether your personal data is being processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing of your personal data and whether it is used in accordance with its purpose,
- Know the third parties to whom your personal data is transferred domestically or abroad,
- Request correction of your personal data if it has been processed incompletely or inaccurately,
- Request the deletion or destruction of your personal data within the conditions provided for in article 7 of the KVKK,
- Request that correction, deletion and destruction operations be notified to third parties to whom your personal data has been transferred,
- Object to the emergence of a result against you by analysis of the processed data solely through automated systems,
- Request compensation for the damage in the event that you suffer damage due to unlawful processing of your personal data.
You may withdraw at any time the consent you have given for processing operations based on explicit consent.
9. Application method
You may submit your requests regarding your rights, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller, through one of the following channels:
- By a wet-signed written petition, in person or by mail: Celal Bayar Caddesi, Sakarya Mahallesi No: 74/A, Gazcılar, Osmangazi / Bursa.
- By e-mail signed with a secure electronic signature or mobile signature to ikrahidropomp@gmail.com.
- By e-mail to ikrahidropomp@gmail.com from the e-mail address you previously notified to us and that is registered in our system.
Your application must include your first name, last name and, in a written application, your signature; your Turkish ID number if you are a citizen of the Republic of Türkiye, or your nationality and passport number or ID number if any if you are a foreigner; your residence or business address for notification; your e-mail address for notification if any, your telephone and fax number; and the subject of your request. You may attach information and documents related to your request. We may request additional information to verify that the application belongs to you.
Your application will be concluded free of charge as soon as possible depending on the nature of the request, and within 30 days at the latest. If the process requires an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board: TL 1 for each page over 10 pages; the cost of the recording medium if the response is provided on a medium such as CD or flash drive. If your application is rejected, if you find the response insufficient or if you do not receive a response within the time limit, you may file a complaint with the Personal Data Protection Board within 30 days of learning of the response and in any case within 60 days of the application date.
To delete your account and your data, you can also use the methods on the Account and Data Deletion page.
10. Cookies, local storage and statistical measurement
Our site's own code does not write HTTP cookies to your browser; records such as your session, cart and preferences are kept in your browser's local storage and session storage areas, and in the Android app in the app's own storage area. Mandatory records are used to provide the service you request and for the secure operation of the site (art. 5/2-c and f). You can disable functional records such as recently viewed products and recent searches from the cookie preferences.
Statistical measurement works only with your explicit consent (art. 5/1) and is disabled by default. If you consent, the pages you browse on the site and in the app, your searches and your order steps are recorded with a random identifier specific to your device; if you are logged in, these records are associated with your account and our fully authorized administrator can view them on a per-person or per-device basis. Records are kept for 13 months and are not used for advertising. You can withdraw your consent at any time via the "Cookie preferences" link at the bottom of the page; when you withdraw, record-keeping stops immediately and statistical records associated with this device and your account are deleted or anonymized within 30 days at the latest.
For the real-time visitor count in the admin panel, only the device type and page type are transmitted to our real-time server with a random, temporary key while the page is open and visible; no identity information is added, nothing is stored anywhere, and it is deleted when the connection is closed (art. 5/2-f).
The full list of records, their retention periods and third-party content are set out in the Cookie Policy; the consent statement for statistical measurement is set out in the Explicit Consent Statement.